_collect_alerts docstring
Taylor committed
Jul 25, 2023 at 11:29 UTC
2554028af5ed0d5e58e80de814a937ce674f92a8
1 file changed
+6
-4
backend/app/services/WazuhIndexer/alerts.py
+6
-4
@@ -380,9 +380,9 @@ class AlertsService:
380
timestamp_field: str = None,
381
) -> Dict[str, object]:
382
"""
383
- Elasticsearch query to get the most recent alerts where the `rule_level` is 12 or higher or the
384
- `syslog_level` field is `ALERT` and return the results in descending order by the `timestamp_utc` field.
385
- The number of alerts to return can be limited by the `size` parameter.
383
+ Constructs an Elasticsearch query to get the most recent alerts based on the provided parameters. By default, it
384
+ fetches alerts where the `syslog_level` field is `ALERT` and returns the results in descending order by the
385
+ `timestamp_utc` field. The number of alerts to return can be limited by the `size` parameter.
386
387
Args:
388
index_name (str): The name of the index to query.
@@ -393,7 +393,9 @@ class AlertsService:
393
timestamp_field (str, optional): The timestamp field to sort by.
394
395
Returns:
396
- Dict[str, object]: A dictionary containing success status and alerts or an error message.
396
+ Dict[str, object]: A dictionary containing success status and alerts or an error message. If successful,
397
+ each alert in the list will be augmented with a `ask_socfortress` field containing results from the
398
+ `invoke_socfortress` function.
399
"""
400
logger.info(f"Collecting alerts from {index_name}")
401